Red Hat CVE-2026-39395

Cosign is a code signing and transparency tool for containers and binaries built on the Sigstore infrastructure. The vulnerability resides in the verify-blob-attestation function, which validates that attestations meet expected schema and predicate type requirements. The root cause (CWE-754: Improper Check for Unusual or Exceptional Conditions) manifests as a logic flaw in error handling during predicate type validation for old-format bundles and detached signatures, and complete bypass of validation for new-format bundles. This allows attestations with invalid payloads or incorrect predicate types to pass verification checks when they should be rejected, undermining the cryptographic guarantees that supply chain tools depend on.